Skip to content
CovaSyn
Log in

Resource · Checklist

GxP Readiness Checklist

Is your chemistry MCP stack ready for an audit under EU GMP Annex 11 and 21 CFR Part 11? 23 checkpoints, classified per GAMP 5 Category 4. Work through the list before a regulated workflow goes live.

All resources

A. Audit Trail

  • 01 Every tool call is logged with user, timestamp (UTC), tool version, model version, input hash, and output hash.
  • 02 Audit trail is tamper-evident (e.g., hash chaining or cryptographic signature).
  • 03 Audit trail retainable for the retention period that applies to your records.
  • 04 Audit trail exportable in machine-readable format (JSON, CSV).
  • 05 Authenticated user is uniquely attributable (no shared service account for regulated calls).

B. Determinism

  • 06 All tool outputs are deterministic: same input → same output.
  • 07 Tool versions are explicitly pinned (not latest, not floating).
  • 08 Model versions (for QSAR, predictive models) are explicitly pinned.
  • 09 Re-run of the same call months later produces byte-identical output.
  • 10 Floating-point determinism across compute hosts (no hardware-dependent numerical drift).

C. Access Control

  • 11 Authentication via secure identity provider setup (OIDC, SAML, or strictly managed API keys).
  • 12 Role-based permissions (reader, writer, admin, at minimum).
  • 13 Access logs separate from audit trail but synchronously consistent.
  • 14 Multi-factor authentication available for admin accounts.

D. Validation Documentation

  • 15 URS (User Requirements Specification) documented.
  • 16 FS (Functional Specification) documented.
  • 17 Configuration is documented (software categorisation GAMP 5 Cat 4 or Cat 5).
  • 18 Risk assessment conducted (FMEA or equivalent).
  • 19 IQ (Installation Qualification) protocol in place.
  • 20 OQ (Operational Qualification) protocol in place.
  • 21 PQ (Performance Qualification) protocol in place.
  • 22 User acceptance testing documented.
  • 23 Change control process for tool updates defined.

Next step

See for yourself which items CovaSyn covers.

Create an account, get your API key, use the tools in your usual working environment.